177.4.12.41:8889

ip not resolving

Tracked by C2 Tracker · Whois queried 2026-10-05T10:39:04

Network

Network: —
CIDR: —
Country: —

Contact

Handle: —
Abuse: —

Observed in malware

Family	Sample SHA-256	First seen
RatHat	5d57a09ee278…	2026-10-04

About RatHat

AI-powered Android credential stealer / RAT (Zimperium, Sep 2026) posing as reward or finance apps (Tether, ReelShort lures). Serializes the live Accessibility tree to XML and queries Google Gemini to resolve on-screen targets and drive synthetic clicks. Heavy anti-analysis: a ~61 MB manifest padded with 0x9999 chunks, DEX poisoning, StringFog/StringCrypto, ZIP tampering. Config lives in a ZM26 container under assets/ (zm26_meta.json + .bt files); the C2 is the serverUrl field of server_config.json - plaintext in some builds, ZM26-encrypted in others. The primary FRP tunnel C2 is fetched at runtime by the Go agent liblocal-service.so, with libmedia_codec.so masquerading the frpc client.

Zimperium: RatHat - AI-powered mobile threat targeting credentials & bank accounts Zimperium IOC repository: 2026-09-RatHat

Signing certificate

Subject CN: Android
Issuer CN: Android
Valid: 2008-02-29 → 2035-07-17
Fingerprint: a40da80a59d170caa950cf15c18c454d47a39b26989d8b640ecd745ba71bf5dc

Other samples signed with this certificate? That's a lead worth checking — but not proof of a shared operator, since signing keys (and the Android debug certificate in particular) are widely reused. See the certificate page for every sample signed with it.